Monday, July 28, 2014

Under Water Bubbles


Bubbles for your locker screen! The background is slightly transparent, your current screen will shine through the blue water.:)
In the screenshots I used my "Octopus Theme" for GO Launcher EX which is a perfect match to the Bubbles Locker Theme.
You can also downlaod it for free on Google Play.
Applying the Theme:
- Make sure GO Launcher EX and GO Locker is installed!
- Go to the GO Launcher EX menu
- Select "Plugins"
- Select "GO Locker"
- Choose and apply the theme

            





Like it ? Share it.

Thursday, July 24, 2014

Install DVWA in Kali Linux


Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.It is a best platform to practice web application hacking and security.

This is Our New Updated Tutorial on DVWA. You can find out our old DVWA Tutorial Here

1. Download DVWA : Click Here
(Click image for large view)

2. Downloaded Zip File

3. Unzip download file

4. Go to DVWA -1.0.8 → DVWA -1.0.8 and Rename DVWA -1.0.8 to dvwa then copy "dvwa" folder. We will paste this folder in our Kali Linux OS. If your Host OS is not shared with your Guest OS then you can use a Pendrive for moving this folder. (If your folder has different name then rename it as dvwa)

5. In Kali Linux Go to Computer → File system → var → www then Paste dvwa folder. Please be sure your folder path is same as mine and Folder name should be also same.


6. Set permission of dvwa into 755. Open Terminal and type
chmod -R 755 /var/www/dvwa and Press enter

7. Run Apache, Go to Application → Kali Linux → System Service → HTTP → apache2start

8. Apache run successfully

9. Run My SQL, Go to Application → Kali Linux → System Service → MySQL → mysql start

10. My SQL run successfully

11. Now Create Database for dvwa
→ Open Terminal  
→ type mysql –u root –p  and Press enter
→ when it ask for Password leave it blank and simply Press enter
→ now type create database dvwa; and Press enter
→ Type exit and Press enter

12. Open Your Internet Browser and Write 127.0.0.1/dvwa in your web address then Press Enter. There you will see an error unable to connect to the database mysql_error ( ). May be this error will be fix by developer within next update. Well Now time to Setup Database.

13. Click on Create/Reset Database

14. Still getting Error Could not connect to the database - please check the config file.

15. For Fixing these errors Go to Computer → File system → var → www → dvwa → config → config.inc.php. Open config.inc.php with text editor (leafpad) then find db_password and remove P@ssword for the line and save it.

16. Open Your Internet Browser and Write 127.0.0.1/dvwa in your web address then Press Enter. There you will see your login page. Write Username - admin and Password - password then Click on Login.

17. We got one more error. - Table 'dvwa_users' doesn't exist

18. Open Your Internet Browser and Write 127.0.0.1/dvwa/setup.php in your web address then Press Enter. You will see your dvwa database setup page. Click on Create/Reset Database after clicking on Create/Reset database button you will get setup successful message.

19. Open Your Internet Browser and Write 127.0.0.1/dvwa in your web address then Press Enter. There you will see your login page. Write Username - admin and Password - password then Click on Login.

20. You have logged in as Admin.
(Click image for large view)
Note - You have to repeat Step 7 - Step 10 each time whenever you will restart your Kali Linux only then 127.0.0.1/dvwa will be work in your browser. 


Like it ? Share it.

Tuesday, July 22, 2014

Introduction Burp Suite Part VII (Decoder Tab)


Burp Decoder is a simple tool for transforming encoded data into its canonical form, or for transforming raw data into various encoded and hashed forms. It is capable of intelligently recognizing several encoding formats using heuristic techniques.

You can load data into Decoder in two ways:
  • Type or paste it directly into the top editor panel.
  • Select data anywhere within Burp, and choose "Send to Decoder" from the context menu.
You can use the "Text" and "Hex" buttons to toggle the type of editor to use on your data.


Smart Decoding
 On any panel within Decoder, you can click the "Smart Decode" button. Burp will then attempt to intelligently decode the contents of that panel by looking for data that appears to be encoded in recognizable formats such as URL-encoding or HTML-encoding. This action is performed recursively, continuing until no further recognizable data formats are detected. This option can be a useful first step when you have identified some opaque data, and want to take a quick look to see if it can be easily decoded into a more recognizable form. The  decoding that is applied to each part of the data is indicated using the usual colorization.
 Because Burp Decoder makes a "best guess" attempt to recognize some common encoding formats, it will sometimes make mistakes. When this occurs, you can easily see all of the stages involved in the decoding, and the transformation that was applied at each position. You can then manually fix any incorrect transformations using the manual controls, and continue the decoding manually or smartly from this point.
(Click image for large view)


Source : Burp Suite Official Site

Like it ? Share it.

Saturday, July 19, 2014

Linux Web Hosting

The definition of Linux Web Hosting is when a company is allowed to build their web sites on the Linux Operating System, which is an open-source variation of the Unix Operating System. Using this particular platform for web development allows the companies to leverage the best and most popular in open-source technologies such as MySQL.Linux hosting is compatible with PHP and MySQL, which supports scripts such as WordPress, Zen Cart, and phpBB.

If I use Linux Hosting, is it necessary my operating system should be Linux?
The answer is NO. The type of hosting you choose has nothing to do with the operating system your PC runs.

Below are some features which provided by WebHosting Companies:

Email Accounts
In this area you can manage the email accounts associated with your domain.You can create your own email accounts. for example if you have a domian www.mysite.com then you can create an email like admin@mysite.com

Webmail
Webmail allows you to access your email from any computer with an Internet connection and a web browser.

BoxTrapper
BoxTrapper protects your inbox from spam by requiring all email senders not on your White list reply to a verification email before you can receive their mail.

Apache SpamAssassin™
Apache SpamAssassin™ is a mail filter to identify spam. It is an intelligent email filter which uses a diverse range of tests to identify unsolicited bulk email, more commonly known as Spam. These tests are applied to email headers and content to classify email using advanced statistical methods.you can enable or disable this feature from your webhosting.

Email Account Forwarders (Forwarders)
Forwarders allow you to send a copy of all mail from one email address to another. For example, if you have two different email accounts, admin@mysite.com and contact@mysite.com, you could forward admin@mysite.com to contact@mysite.com so that you do not need to check both accounts. Note that the forwarded mail will still be delivered to the original address as well.

Auto Responders
You can use auto responders to send a message back automatically to anyone who sends an email to a specified account. This can be useful for times when you are on vacation or unavailable, or if you have a generic message that you wish to send from a support email address.

Set Default Address
The default email address will “catch” any mail that is sent to an invalid email address for your domain.

Mailing Lists
Mailing lists can simplify sending messages to a large group of people. You can add a group of email addresses to a mailing list to avoid typing those addresses each time you send a message. This can be very useful when sending newsletters or other updates to large groups of people.

Edit Filters for All Mail On Your Account (Account Level Filtering)
In this area you can manage filters for your main account.

User Level Filtering
In this area, you can manage filters for each user. Each user filter is processed after the main account filters.


Email Trace
This feature allows you to review email delivery attempts for your account. You can see details of each delivery attempt, including whether a message was delivered successfully.

Import E-mail Accounts/Forwarders
This feature allows you to use 2 types of files to create multiple email address or email forwarders for your account simultaneously. You may use Excel spreadsheet files (.xls) or comma-separated values sheet, aka CSV file (.csv) to import the data. A CSV file is a plain text file that has been given a .csv extension.

Email Authentication
Email authentication helps prevent spam. The options below attempt to equip email messages with verifiable information so that the nature of incoming and outgoing messages can be detected automatically.
Enabling these features should reduce the number of failed delivery notifications you receive when spammers forge messages from your domain(s). These features also work to prevent spammers from forging messages that claim to be from your domain(s).

MX Entry Maintenance
An MX (mail exchanger) entry tells a client which server receives mail sent to a domain name.

Backups
Backups allow you to download (to your computer) a zipped copy of either your entire site (including your home directory, databases, email forwarders configuration, and email filters configuration) or one of the previously mentioned parts of your site.

Disk Space Usage
The cPanel Disk Usage Viewer provides an overview of the disk space that your account is using. It shows disk usage totals for your account’s directories and all of its databases rather than for individual files or databases.

Web Disk Accounts
The Web Disk feature is cPanel's implementation of the WebDav protocol. This feature allows you to manage files associated with your website. By creating an account and accessing your Web Disk, you can navigate, upload, and download files to and from your web server as though they were part of your personal computer.

FTP Accounts
FTP accounts allow you to access your website's files through a protocol called FTP. You will need a third-party FTP program to access your files.

File Manager
Upload new files and work with current files and directories of your websites.

FTP Session Control
You can use this function to see who is currently logged into your site through FTP. You can also terminate any FTP connections to your site that you feel should not be open. This can be very useful in preventing users from accessing your files without your permission.

Latest Visitors Stats
This function displays the most recent entries in the Apache log for a given domain’s web site.

Bandwidth
This function allows you to see the bandwidth usage for your site. It shows the current month’s bandwidth usage, as well as your total bandwidth usage. This will include all HTTP (web) and POP (mail) bandwidth usage, and may include FTP bandwidth usage if your system administrator has enabled FTP bandwidth logging.

Webalizer Stats
Webalizer is a complex stats program that produces a variety of charts and graphs about who has visited your site.

Raw Access Log
Raw Access Logs allow you to see who has visited your website without displaying graphs, charts or other graphics. You can use the Raw Access Logs menu to download a zipped version of the server’s access log for your site. This can be very useful when you want to quickly be able to see who is visiting your site.

Analog Stats
Analog produces a simple summary of all the people who have visited your site. It is fast and provides great lightweight statistics. Analog shows the people who have accessed your site during a specific month. It provides limited content but can be helpful to see where your main users are from.

Error Log
This function will display the last some errors for your site. This can be very useful for finding broken links or problems with missing files. Checking this log frequently can help keep your site running smoothly.

Choose Log Programs
This function allows you to choose what stats programs you will use when viewing site statistics, if you are allowed to do so.

Awstats
Awstats produces visual statistics about visitors of your site.

Password Protect Directories 
This feature allows you to protect your directories with password.

IP Deny Manager
This feature will allow you to block a range of IP addresses to prevent them from accessing your site. You can also enter a fully qualified domain name, and the IP Deny Manager will attempt to resolve it to an IP address for you.

SSL/TLS Manager
The SSL/TLS Manager will allow you to generate SSL certificates, certificate signing requests, and private keys. These are all parts of using SSL to secure your website. SSL allows you to secure pages on your site so that information such as logins, credit card numbers, etc are sent encrypted instead of plain text. It is important to secure your site’s login areas, shopping areas, and other pages where sensitive information could be sent over the web.

SSH/Shell Access
SSH allows secure file transfer and remote logins over the internet. Your connection via SSH is encrypted allowing the secure connection. In this section you can manage your SSH keys to allow automation when logging in via SSH. Using public key authentication is an alternative to password authentication. Since the private key must be held to authenticate, it is virtually impossible to brute force. You can Import existing keys, generate new keys, as well as manage/delete keys.
The public and private key are similar to a puzzle. They are created together to use during the login/authentication process. The public key resides on the server (the remote location) The private key resides locally on your computer/server. When you attempt to login to a server, the public and private key are compared. If they "match", then you will be allowed to login to the server location.

Hotlink Protection
Hotlink protection prevents other websites from directly linking to files on your website. Other sites will still be able to link to any file type that you don’t specify. An example of hotlinking would be using a <img> tag to display an image from your site from somewhere else on the net. The end result is that the other site is stealing your bandwidth. List all sites below from which you wish to allow direct links. This system attempts to add all sites it knows you own to the list; however, you may need to add others.

Leech Protect Directories
Leech Protect allows you to prevent your users from giving out or publicly posting their passwords to a restricted area of your site. This feature will redirect accounts which have been compromised to a URL of your choice (and suspend them, if you choose).

GnuPG Keys
GnuPG is a publicly available encryption scheme that uses the "public key" approach. With GnuPG, messages are encrypted using a "public key" however, they can only be decrypted by a "private key", which is retained by the intended recipient of the message.

Subdomains
Subdomains are URLs for different sections of your website. They use your main domain name and a prefix. For example, if your domain is mysite.com a sub-domain of your domain might be support.mysite.com.

Addon Domains
An addon domain allows visitors to reach a subdomain of your site by typing the addon domain's URL into a browser. This means that you can host additional domains from your account, if allowed by your hosting provider. Addon domains will not function unless the domain name is registered with a valid registrar and configured to point to the correct DNS servers.

Parked Domains
Parked Domains (Domain pointers) allow you to "point" or "park" additional domain names to your existing hosting account. This will allow users to also reach your website when entering the "parked" or "pointed" domain into their browsers. Domains must be registered with a valid registrar before they can be parked. In addition, they will not be functional unless they are configured to point to your DNS servers.

Redirects
Redirects allow you to make a specific web page redirect to another page and display the contents of that page. This way you can make a page with a long URL accessible by a page which has a shorter and easier to remember URL.

Simple DNS Zone Editor
DNS is the component of the Internet which converts human-readable domain names (e.g. mysite.com) into computer-readable IP addresses (e.g. 91.237.86.220). It does this according to DNS zone files that reside on your server which tie domain names to IP addresses.
There are several different types of records in a domain's zone file. This feature allows you to create and edit A and CNAME records.

MySQL Databases
MySQL Databases allow you to store lots of information in an easy to access manner. The databases themselves are not easily read by humans. MySQL databases are required by many web applications including some bulletin boards, content management systems, and others. To use a database, you’ll need to create it. Only MySQL Users (different than mail or other users) that have privileges to access a database can read from or write to that database.

phpmyadmin
intended to handle the administration of MySQL

Access cPanel Shortcuts
cPanel shortcuts are links you can add to your desktop or your browser’s bookmarks toolbar. They are an easy way to access your cPanel.

Apache Handlers
Apache handlers control how the Apache web server software manages certain file types and extensions for your site. Apache comes configured to handle CGI scripts and server-parsed files.

Image Tools
The Image Manager allows you to view and modify images in your account. You can change the size of your images, convert their file types, or just view them.

Index Manager
The Index Manager allows you to customize the way a directory will be viewed on the web. You can select between a default style, no indexes, or two types of indexing.

Error pages
An error page informs a visitor when there is a problem accessing your site. Each type of problem has its own code. For example, a visitor who enters a nonexistent URL will see a 404 error, while an unauthorized user trying to access a restricted area of your site will see a 401 error.

Cron Jobs
Cron jobs allow you to automate certain commands or scripts on your site. You can set a command or script to run at a specific time every day, week, etc. For example, you could set a cron job to delete temporary files every week to free up disk space. You need to have a good knowledge of Linux commands before you can use cron jobs effectively.

Network Tools
Network Tools allow a user to find out information about any domain, or to trace the route from the server your site is on to the computer you are accessing cPanel from. Finding out information about a domain can be useful in making sure your DNS is set up properly as you will find out information about your IP address as well as your DNS.

MIME Types
MIME types tell browsers how to handle specific extensions. For example, the text/html MIME type equates to .htm, .html, and .shtml extensions on most servers, and this tells your browser to interpret all files with those extensions as HTML files. You can alter or add new MIME types specifically for your site (note that you can not alter the system defined MIME type values). MIME types are often used to handle new technologies as they appear. When WAP technology first appeared no one had these extensions set up on their server. With MIME types, however, you could have set it up yourself and begun serving WAP pages immediately.

FrontPage Extensions
FrontPage Extensions allow you to publish your site directly from the FrontPage application. This means that you will not have to upload files through FTP or another method.

Note - Above Features list are just an example. May be you will get more features or less features its depend on the hosting provider companies. Some webhosting also provides some software and services like joomla, wordpress etc.

Saturday, July 5, 2014

Introduction Burp Suite Part VI (Sequencer Tab)


Burp Sequencer is a tool for analyzing the quality of randomness in an application's session tokens and other important data items that are intended to be unpredictable.




Live Capture
 To perform a live capture, you need to locate a request within the target application that returns somewhere in its response the session token or other item that you want to analyze. You can do this by selecting a request anywhere within Burp and choosing the "Send to Sequencer" option from the context menu. The steps needed to configure the live capture on this request are described below.

Select Live Capture Request
 The live capture request list shows the requests that you have sent to Sequencer from other Burp tools. Select the request that returns the token or other item that you want to analyze.
(Click image for large view)

Token Location Within Response
 Select the location within the application's response where the token appears. The following options are available:
  • Cookie - If the response sets any cookies, this option will let you select a cookie to analyze. This is the most common method of passing session tokens to clients.
  • Form field - If the response contains any HTML form fields, this option will let you select a form field value to analyze. This method is often used for transmitting anti-CSRF tokens and other per-page tokens to clients.
  • Custom location - You can use this option to specify a specific custom location within the response containing the data you want to analyze. This is done using the response extraction rule dialog.
Live Capture Options
 These settings control the engine used for making HTTP requests and harvesting tokens when performing the live capture. The following options are available: 
  • Number of threads - This option controls the number of concurrent requests the live capture is able to make.
  • Throttle between requests - Optionally, the live capture can wait a specified delay (in milliseconds) before every request. This option is useful to avoid overloading the application, or to be more stealthy.
  • Ignore token whose length deviates by X characters - You can optionally configure the live capture to ignore tokens whose length deviates by a given threshold from the average token length. This can be useful if the application occasionally returns an anomalous response containing a different item in the location where the token normally appears.

Running the Live Capture
 When you have fully configured the live capture, click the "Start live capture" button to begin the live capture. Burp Sequencer will repeatedly issue your request and extract the relevant token from the application's responses.
 During the live capture, a progress bar is shown, with counters of the numbers of tokens, requests, and network errors. The following options are available: 
  • Pause / resume - This temporarily pauses, and resumes, the capture.
  • Stop - This permanently stops the capture.
  • Copy tokens - This copies the currently captured tokens to the clipboard, for use in other Burp attacks (such as in Intruder payloads) or tools.
  • Save tokens - This saves the currently captured tokens to file.
  • Auto-analyze - If this option is enabled, Burp will automatically perform token analysis and update the results periodically during the live capture.
  • Analyze now - This is available when a minimum of 100 tokens have been captured, and causes Burp to analyze the current sample and update the results.
Manual Load
 This function allows you to load Sequencer with a sample of tokens that you have already obtained, and then perform the statistical analysis on the sample.
 To perform a manual load, you first need to obtain your own sample of tokens from the target application through some means, such as your own script or the output from an earlier live capture, or an Intruder attack. The tokens need to be in a simple newline-delimited text format.
 Use the Paste button to paste the tokens from the clipboard, or the Load button to load them from file. The loaded tokens, together with details of the shortest and longest lengths, are displayed for you to sense-check that the sample has loaded correctly.
 To perform the analysis of the loaded tokens, click the "Analyze now" button.

Analysis Options
 The "Analysis options" tab lets you configure how tokens are handled, and which types of tests are performed during the analysis.

Token Handling
 These settings control how tokens are handled during analysis. The following options are available:
  • Pad short tokens at start / end - If the tokens produced by the application have variable length, these will need to be padded to enable the statistical tests to be performed. You can choose whether the padding should be applied at the start or the end of each token. In most cases, padding tokens at the start is most appropriate.
  • Pad with - You can specify the character that will be used for padding. In most cases, for numeric or ASCII hex-encoded tokens, padding with the "0" character is most appropriate.
  • Base64-decode before analyzing - If the tokens are Base64-encoded, you can configure Burp to decode these before analyzing, which will generally improve the accuracy of the analysis.
Token Analysis
 These options control the types of analyses that are performed. You can individually enable or disable each type of character-level and bit-level test. Sometimes, after performing an initial analysis with all tests enabled, you may want to disable certain tests to reflect your better understanding of the tokens' characteristics, or to isolate the effects of any unusual characteristics manifested by your sample.
 In the results window, after modifying any of the analysis options you can click the "Redo analysis" button to re-perform the analysis with your new settings, and update the results.
(Click image for large view)

Like it ? Share it.

Tuesday, July 1, 2014

Orkut going to shutdown officially


Google launched Orkut in January 2004, and now It was announced today that Google intends to shut down its very first social network, Orkut. As of September 30, 2014, Orkut will no longer be available.

The Orkut Team Says : 
Ten years ago, Orkut was Google’s first foray into social networking. Built as a “20 percent” project, Orkut communities started conversations, and forged connections, that had never existed before. Orkut helped shape life online before people really knew what “social networking” was.
Over the past decade, YouTube, Blogger and Google+ have taken off, with communities springing up in every corner of the world. Because the growth of these communities has outpaced Orkut's growth, we've decided to bid Orkut farewell (or, tchau). We'll be focusing our energy and resources on making these other social platforms as amazing as possible for everyone who uses them.
It's been a great 10 years, and we apologize to those still actively using the service. We hope people will find other online communities to spark more conversations and build even more connections for the next decade and beyond.




Eric Schmidt, former CEO of Google and current executive chairman, has repeatedly admitted over the years that his biggest mistake running the company was missing out on social. “In our defense," he said in one interview late last year, "we were busy working on many other things but we should have been in that area and I take responsibility for that."

If you were a user of Orkut, you will be able to export data using Google Takeout until September 2016. The Orkut team also intends to preserve an archive of all public communities, which will be available online starting September 30, 2014.


Like it ? Share it.

Monday, June 30, 2014

Introduction Burp Suite Part V (Repeater Tab)


Burp Repeater is a simple tool for manually manipulating and reissuing individual HTTP requests, and analyzing the application's responses. You can use Repeater for all kinds of purposes, such as changing parameter values to test for input-based vulnerabilities, issuing requests in a specific sequence to test for logic flaws, and reissuing requests from Burp Scanner results to manually verify reported issues.
The easiest way to start working with Repeater is to select the request you want to work on within another Burp tool (such as the Proxy history or Target site map), and use the "Send to Repeater" option on the context menu. This will create a new request tab in Repeater, and automatically populate the target details and request message editor with the relevant details. You can then modify and issue the request as required.
 When your request is ready to send, click the "Go" button to send it to the server. The response is displayed when this is received, together with the response length and a timer (in milliseconds). You can use the usual HTTP message editor functions to help analyze the request and response messages, and carry out further actions.

Managing Request Tabs
 You can easily manage Repeater's request tabs. You can: 
  • Rename tabs by double-clicking the tab header.
  • Reorder tabs by dragging them.
  • Open a new tab by clicking on the right-most "..." tab.
  • Close tabs by clicking the X button in the tab header.
(Click image for large view)



Like it ? Share it.